x0 Home Excel add-in

Excel add-in (Office.js)

Guided Xero → Excel setup: sign in to x0, create an API token, load a table, copy Power Query M.

Install

  1. Open Excel add-in on the portal: /excel/addin/
  2. Download x0-excel-addin.xml (/addin/manifest.xml)
  3. Excel → Insert → My Add-ins → Upload My Add-in → choose the manifest
  4. Home ribbon → Connect x0

IT can publish the manifest URL in a trusted catalog instead.

The task pane is hosted at /addin/taskpane/ (must be HTTPS). Preview the wizard in a browser at that URL (no Excel APIs; sign-in still works).

Wizard

Step What happens
Sign in Office dialog opens /addin/auth/. If you are not logged in, x0 login (then back to the dialog).
Create token POST /addin/api/token/ issues a one-time excel-addin key (live unless free/demo). Shown once.
Store Token stays in add-in storage on this device — not written into the workbook.
Load GET {API}/odata/v1/{Table} with Bearer (+ optional tenant_id). Writes an Excel table (≤500 rows).
Forms NZ A4 stationery (invoice, PO, quote, statement, inventory tfr, faulty return, works order, …): download /excel/forms.xlsx, then New / Update / Print / Email PDF. Set From: on /dashboard/email/; review sends on /dashboard/email/sent/.
Power Query Copy M: OData.Feed + Authorization: Bearer …. Credentials = Anonymous.

If no Xero org is connected, the wizard links to Connect Xero.

APIs (portal session)

Method Path Auth
GET /addin/manifest.xml public
GET /addin/taskpane/ public (frameable)
GET /addin/auth/ login; dialog
GET /addin/api/context/ session JSON
POST /addin/api/token/ session JSON + CSRF

Security

  • Task pane allows framing (X-Frame-Options exempt) so Excel Online can host it.
  • Auth dialog is a separate window (not framed) and uses normal clickjacking protection.
  • New token every time you click Create Excel token (old excel-addin keys remain until revoked on the dashboard).
  • Do not email workbooks that contain pasted M with a live Bearer token.

Code signing / trust

Office.js add-in manifests are XML, not an executable — they are never
Authenticode-signed the way a .exe/.msi is. Trust comes from where the
manifest is deployed and whether the taskpane is HTTPS, not from a
certificate on the manifest itself:

Deployment path Signing needed? Notes
Sideload ("Upload My Add-in" — current path, above) No Fine for one user/device testing; each person uploads the manifest themselves.
Microsoft 365 admin center — Centralized Deployment No code signing Microsoft's recommended org-wide path. Admin points it at the manifest URL; requires HTTPS on every URL in the manifest (taskpane, commands, icons, the API).
SharePoint app catalog No code signing Older org-wide path; same HTTPS-only requirement. Doesn't support VersionOverrides (ribbon commands).
AppSource / Microsoft Marketplace No Authenticode, but mandatory HTTPS + commercial marketplace certification review Only relevant if x0 goes for public marketplace listing.

What is actually needed to go beyond sideloading:

  1. A verified publisher Microsoft 365 tenant (or the customer's own tenant
    admin) to approve Centralized Deployment / the app catalog.
  2. HTTPS on the taskpane host and every other manifest URL (already true
    for /addin/* in production).
  3. Optionally, a Microsoft Partner Center account only if x0 later lists
    on AppSource — not required for direct customer/tenant deployment.

If x0 ever ships a native installer (a .exe/.msi wrapping a VSTO/
ClickOnce desktop add-in, not the current Office.js task pane), that binary
should be signed with an Authenticode EV certificate to avoid SmartScreen
warnings — this does not apply to the Office.js manifest/taskpane path
documented above.

Sign in to see connection status